Linux container & docker

transcript

Containerization, Docker

ejlp12@gmail.comIndonesia

Familiar with Virtualization?

Hardware/Platform VirtualizationThe virtualization of computers as complete hardware platforms, certain logical abstractions of their componentry, or only the functionality required to run various operating systems.

CPU Memory NIC Disk

Virtualization Layer

Operating System

App App App

Operating System

App App App

Hardware Virtualization Techniques

Virtualization Techniques:

● Full Virtualization using Binary Translation● OS Assisted Virtualization or Paravirtualization● Hardware Assisted Virtualization

Type-1 vs. Type-2

Guest VM Guest VM

Guest OS Guest OS

VMM (Hypervisor)

Hardware

Host OS

Bare metal architecture● Xen, VMware ESX server, Hyper-V● Mostly for server, but not limited● VMM by default● OS-independent VMM

Hosted architecture.● VMware Workstation, VirtualBox● Mostly for client devices, but not limited● VMM on demand● OS-dependent VMM

Guest OS

Guest VM

Guest OS

Guest VM

VMM (Hypervisor)

Hardware

Guest OS

Guest VM

Depending on what sits right on Hardware

What is Linux Container?● Lightweight virtualization.● OS-level virtualization● Allow single host to operate multiple isolated & resource-controlled Linux

Instances.● included in the Linux kernel called LXC (Linux Container)

Containers are not a new technology: the earliest iterations of containers have been around in open source Linux code for decades.

!!! LXC term can refer to a Linux container technology but in other context can refer to a tool for container management

Hypervisor vs Linux Container

Guest VM

VMM (Hypervisor)

Hardware

bins / libs

App App

Guest VM

bins / libs

App App

Guest VM

bins / libs

App AppContainer

Operating System (Host)

Hardware

bins / libs

App App

Container

App App

Container

bins / libs

App App

Type 1 Hypervisor Linux Container

OS-Level Virtualization

FreeBSD jail

AIX Workload partitions (WPARs)

Solaris Containers(Zones)

OpenBSD sysjail

https://en.wikipedia.org/wiki/Operating-system-level_virtualization#IMPLEMENTATIONS

https://github.com/google/lmctfy lmctfy

http://linux-vserver.org

Containers Containers Containers

Container Architecture (Example)● namespaces allows complete isolation of an

applications' view of the operating environment, including process trees, networking, user IDs and mounted file systems.

● cgroups: allows limitation and prioritization of resources (CPU, memory, block I/O, network, etc.)

● Security-Enhanced Linux (SELinux) provides secure separation of containers by applying SELinux policy and labels. It integrates with virtual devices by using the sVirt technology.Hardware/VM

Drivers

namespaces cgroups SELinux

Management Interface

Containers Containers ContainersContainers Containers Containers

Linux Kernel

Linux Container TechnologyUnderlying technology:

● namespace/cgroups○ veth ○ union fs(AUFS) ○ netfilter/chroot/tc/quota

● Low-level container management ○ LXC/libvirt

● Security related○ grsec/apparmor/SELinux

● High-level container/image management○ docker/warden/garden/lmctfy/openVZ

Linux Container TechnologyContainer supports separation of various resources. They are internally realized with different technologies called "namespace."

– Filesystem separation → Mount namespace (kernel 2.4.19) – Hostname separation → UTS namespace (kernel 2.6.19) – IPC separation → IPC namespace (kernel 2.6.19) – User (UID/GID) separation → User namespace (kernel 2.6.23〜kernel 3.8) – Processtable separation → PID namespace (kernel 2.6.24) – Network separation → Network Namespace (kernel 2.6.24) – Usage limit of CPU/Memory → Control groups

Container Technologies (Open Source Projects)

Benefit of Container over Virtualization● Linux Containers are designed to support isolation of one or more applications.

● System-wide changes are visible in each container.

For example, if you upgrade an application on the host machine, this change will apply to all

sandboxes that run instances of this application.

● Since containers are lightweight, a large number of them can run simultaneously on a host machine.

The theoretical maximum is 6000 containers and 12,000 bind mounts of root file system directories.

How big is the container?Top 10 image sizes (latest tag) on Docker Hub today

IMAGE NAME SIZE

busybox 1 MB

ubuntu 188 MB

swarm 17 MB

nginx 134 MB

registry 423 MB

redis 151 MB

mysql 360 MB

mongo 317 MB

node 643 MB

debian 125 MB

Some minimal Docker images built on top of Alpine:

IMAGE NAME SIZE

Nginx 28 Mb

64 Bit Server JRE 8 124 Mb

64 bit JDK 8 165 Mb

Redis 12 Mb

Minimalistic OSA tiny Linux distribution created for container

http://rancher.com/rancher-os/

https://developer.ubuntu.com/en/snappy/

http://www.projectatomic.io/

https://coreos.com/http://osv.io/

https://vmware.github.io/photon/

http://boot2docker.io/

Minimalist OSA common set of ideas:

● Stability is enhanced through transactional upgrade/rollback semantics.

● Traditional package managers are absent and may be replaced by new packaging systems (Snappy), or custom image builds (Atomic).

● Security is enhanced through various isolation mechanisms.

● systemd provides system/service management. In general, systemd has been adopted almost universally among Linux distributions, so this shouldn’t be a surprise.

Minimalistic OS Comparison

https://blog.inovex.de/docker-a-comparison-of-minimalistic-operating-systems/

CoreOS (647.0.0) RancherOS (0.23.0) Atomic (F 22) Photon Snappy (edge –

Size 164MB 20MB 151/333MB 251MB 111MB

Kernel version 3.19.3 3.19.2 4.0.0 3.19.2 3.18.0

Docker version 1.5.0 1.6.0 1.6.0 1.5.0 1.5.0

Init system systemd Docker systemd systemd systemd

Package manager None (Docker/Rocket) None (Docker) Atomic tdnf (tyum) Snappy

Filesystem ext4 ext4 xfs ext4 ext4

Tools Fleet, etcd – Cockpit (Anaconda, kickstart), atomic –

Will Containers Kills VM?Containers need to all run on the same OS and can’t be mixed between Linux and Windows, for example.

Users with heterogeneous environments that include multiple operating systems and different security controls will likely still use a VM-focused architecture.

DOCKER

Docker Components

libcontainer - https://github.com/docker/libcontainerLXC - https://linuxcontainers.org/libvirt - http://libvirt.org/systemd-nspawn - https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html

still evolving...

Docker version > 0.9

https://github.com/opencontainers/runc

Containerization standard?

https://www.opencontainers.org/runC

https://github.com/opencontainers/runc

runc is a CLI tool for spawning and running containers according to the OCF specification

Docker Technology: runC and containerda new daemon to control runC called: containerd.

https://containerd.tools/

What you can do with Docker

Container

bins / libs

Dockerimage

Dockerfile

OS image

Describes the steps to build an image

(1) Auto-build Docker images

(2) Upload and publish images

(3) Download and run

Docker HostDocker Hub

(Image Repository)

Everything you need to run application is included in the image

PaaS products based on Container

https://tsuru.io/

https://flynn.io/https://github.com/dawn/dawn

http://www.octohost.io/

https://www.openshift.org/

http://getcloudify.org/

https://www.cloudfoundry.org/

http://deis.io/

https://github.com/Yelp/paasta

http://stratos.apache.org/

PaaS ModelC

Container / Artifact / Runtime

Discovery / Routing

Deployment / Scheduling

Monitoring

Docker Containers

Kubernetes Loadbalancer

Replication Controller

Example

Thanks!

Linux container & docker

Software